urlscan.io Blog - Announcements, Product News, Tutorials, Service Incidents
Live Last read · last published · next check
This report documents two closely related phishing clusters identified by the urlscan Threat Research Team, both targeting social media users, primarily YouTube content creators, with the goal of gaining access to Google accounts. Both clusters employ a multi-stage phishing flow, beginning with a YouTube-themed lure and culminating in a highly engineered Browser-in-the-Browser (BitB) technique…
The urlscan Threat Research Team identified a phishing site impersonating Prove, an identity verification provider, which stood out due to the notable nature of the company being targeted. A single distinctive JavaScript global variable present on the page provided an effective starting point for clustering, ultimately revealing a shared phishing framework used against a range of smaller and…
CY-Kit represents a dangerous evolution in phishing, moving beyond simple credential harvesting to a “live puppeteer” model where operators control victim sessions in real time via Socket.IO. This Chinese-backed framework features an invasive toolset that includes live social-engineering chat, the ability to silently capture victim photos via webcam, and dynamic “HackerInput” monitoring to observe…
Oriental Gudgeon, also known as CoGUI, has undergone a major architectural shift toward a centralized encrypted wrapper model to mask its global phishing operations. This latest iteration employs defensive anti-analysis techniques, such as randomized local storage artifacts and encrypted API routing, while maintaining a heavy focus on US government entities and APAC financial institutions. Read…
The Darcula phishing framework continues to evolve, transitioning from early API-driven roots to a sophisticated “Phishing-as-a-Service” model using encrypted WebSockets and wrapper APIs. Our latest research uncovers the inner workings of Darcula, its expansion into fake e-commerce storefronts via the “NewBee” and “PandaShop” ecosystems, and its persistent targeting of government and financial…
The Sailor Framework has emerged as a highly specialized Chinese-backed phishing ecosystem, moving away from broad industry attacks to dominate a specific vertical: U.S. state government and tolling infrastructure. By utilizing AES-encrypted WebSockets and modular “branches” like Sailors and globalConfig, the platform evades traditional detection while harvesting sensitive payment and identity…
Phishing campaigns that impersonate a single brand are often assumed to come from a single source, but that assumption rarely holds up. Calendly is a widely used scheduling platform for booking meetings and interviews, making it a highly believable lure in phishing campaigns. Calendly-themed phishing shows how one trusted workflow can be abused by multiple, unrelated phishing kits at the same…
Over the past several months, the urlscan Threat Research Team has conducted extensive research to identify, cluster, and track some of the most impactful Chinese-language phishing-as-a-service (PhaaS) ecosystems operating at a global scale. This research combines large-scale telemetry, infrastructure analysis, and campaign tracking to better understand how these services are structured, operated,…
During routine monitoring of malicious web activity on the urlscan platform, the urlscan Threat Research Team identified a phishing campaign abusing the Ultraviolet (UV) client-side proxy framework. This framework was being leveraged to obscure attacker infrastructure, evade traditional detection methods, and deliver high-fidelity credential harvesting content.
We are excited to be heading to PIVOTcon, where we will host a hands-on workshop focused on hunting phishing pages and infrastructure. If you are attending the conference, this is a great opportunity to connect with us and learn how to take make full use of our community and urlscan Pro platforms. Workshop: Uncovering Phishing InfrastructureA Hands-On Workshop with urlscan.io In this interactive…
